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Nomenclature 

PF  probability  of  laser  system  fault  or  failure  during  laser  firing  maneuver 

i9max  maximum  angular  drift  of  laser  sightime  error 
cr  root-mean-square  (RMS)  fault-free  laser  pointing  error 

amax  maximum  fault-free  laser  pointing  error 

EMOVl  expected  number  of  observers  who  sustain  a  minimum  ophthalmoscopically  vis¬ 

ible  lesion  (MOVL)  during  laser  firing  maneuver 
EMOVLMAXmaximum  acceptable  value  of  EM0VL 

Econmax  maximum  acceptable  value  of  EM0VL  for  laser  firing  maneuver  where  laser  en¬ 
ergy  is  inadvertently  misdirected  outside  controlled  range  area  (CRA) 

P  mov '.max  maximum  acceptable  value  of  probability  that  irradiated  individual  will  sustain 
a  MOVL 

co  radial  line  that  emanates  from  target  and  crosses  range  boundary  only  once 

R((o)  maximum  laser  firing  range-to-target  for  aircraft  approach  along  radial  co,  as¬ 
suming  that  fault-free  laser  pointing  errors  remain  within  CRA 
Rfco)  maximum  laser  firing  range-to-target  for  aircraft  approach  along  radial  co,  as¬ 
suming  that  “undershoot”  fault-free  laser  pointing  errors  remain  within  CRA 
R0{w)  maximum  laser  firing  range-to-target  for  aircraft  approach  along  radial  co,  as¬ 
suming  that  “overshoot”  fault-free  laser  pointing  errors  remain  within  CRA 
h  aircraft  height  (or  altitude) 

eM0VL  expected  number  of  observers  who  sustain  a  MOVL  for  a  single  laser  pulse, 
emitted  during  a  laser  firing  maneuver 


1.  Introduction 

Recently,  the  use  of  probabilistic  risk  assessment  (PRA)  techniques1,2  to  perform  laser  safety 
and  hazard  analysis  for  high  output  lasers  in  outdoor  environments3"6  has  become  an  in¬ 
creasingly  accepted  alternative  to  standard  risk  analysis  methods,  based  on  maximum  per¬ 
missible  exposure  (MPE)  limits.7,8  Over  the  past  1 0  years,  the  UK  Ministry  of  Defence 
(MoD)  and  the  U.S.  Air  Force  Research  Laboratory  (AFRL)  have  collaborated  to  develop 
a  jointly  owned,  PRA -based,  laser  range  safety  tool,  the  Military  Advanced  Technology  In¬ 
tegrated  Laser  Hazard  Assessment  (MATILDA)  system.9"13 

The  move  towards  PRA,  by  some  laser  safety  experts  and  organizations,  has  been 
driven  by  the  limitations  ofgtandard,  or  MPE-based,  risk  analysis.  In  a  standard  risk  analy¬ 
sis,  exposures  are  simplycharacterized  as  safe  or  unsafe  based  on  comparison  to  the  MPE; 
no  quantitative  estimate  of  risk  is  provided.  Standard  risk  analysis  also  implicitly  assumes 
that  risk  can  be  completely  mitigated,6  giving  a  “sure-safe,”  or  zero  risk,  condition  as  a  final 
result.  In  controlled  indoor  environments,  such  as  factories  or  labs,  this  may  be  true,  or 
nearly  true.  In  uncontrolled  outdoor  environments,  such  as  military  test  ranges  or  combat 
operations,  a  true  zero-risk  condition  is  unachievable.  Thus,  a  method  giving  a  quantitative 
estimate  of  risk  (PRA)  is  preferable. 

PRA-based  laserLhazard  analysis  offers  a  number  of  advantages  over  standard  risk  analy¬ 
sis  methods.  First,  it  provides  a  quantified  assessment  of  human  risk  (probability  of  injury) 
as  a  function  of  location.  Second,  it  captures  the  probabilities  and  consequences  of  human 
error  and  laser  fault/failure  conditions,  factors  that  are  critical  to  valid  hazard  assessments 
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for  military  laser  operations  in  uncontrolled  outdoor  environments.  Third,  and  most  impor¬ 
tantly,  PRA  analysis  does  not  assume,  or  require,  a  zero-risk  condition  as  a  final  result.  In¬ 
stead,  it  compares  the  quantified  risk  against  a  maximum  acceptable  (non-zero)  risk  value. 
This  produces  less  restrictive  range  clearances,  while  still  maintaining  acceptable  safety  lev¬ 
els  for  range  personnel  and  members  of  the  public.  This  last  advantage  is  critical  for  the  UK, 
where  the  small  size  of  UK  ranges  and  the  possibility  that  laser  beams  might  escape  range 
boundaries  make  a  zero-risk  condition  for  range  testing  unacceptably  restrictive. 

The  UK  MoD  has  been  developing  PRA-based  laser  hazard  analysis  models  for  nearly 
four  decades,  and  using  them  to  assess  laser  irradiation  risks  to  unprotected  persons  from  laser 
test  and  training  operations  on  UK  military  ranges.  Over  that  time,, PRA-based  range  clearance 
techniques  have  ensured  the  safe  operation  of  airborne  and  ground-based  military  laser  range 
finders  and  target  designators  during  development  trials  and  operational  training  exercises. 
Prior  to  the  US-UK  collaboration,  however,  the  MoD  had  not  allocated  the  resources  to  create 
an  expert  software  tool  like  MATILDA,  which  performs  a  complete  end-to-end  PRA  hazard 
analysis  for  airborne  laser  range  applications,  with  generalized  terrain  modeling. 

Beginning  in  1998,  with  AFRL  safety  support  to  the  Airborne  Laser  (ABL)  and  Ad¬ 
vanced  Tactical  Laser  (ATL)  programs,  the  United  States  Air  Force  (USAF)  had  the  goal 
of  developing  PRA-based  hazard  analysis  models  for  outdoor  high  energy  laser  (HEL)  ap¬ 
plications.  Very  long  HEL  hazard  distances,  combined  with  the  uncertainties  inherent  in 
outdoor  operations,  make  zero  risk  unachievable  in  HEL  range  tests.  Thus,  in  assessing  the 
potential  risks  posed  by  HEL  operations,  a  shift  to  probabilistic  analysis  is  preferable.  The 
United  States  began  the  collaboration  described  in  this  paper  in  order  to  leverage  the  PRA 
modeling  expertise  of  the  UK,  with  an  eye  to  future  development  of  an  HEL  PRA  tool.  De¬ 
velopment  of  U.S.  HEL  PRA  tools  is  in  fact  underway  at  this  time,  but  it  has  not  been  com¬ 
pleted  and  will  not  be  documented  here.  The  purpose  of  this  paper  is  to  document  the 
development  and  capabilities  of  the  MATILDA  tool,  which  is  currently  valid  only  for  direct 
beam  hazards  created  by  low-to-moderate  power  airborne  laser  designators,  operating  at 
1064  nm,  and  firing  at  stationary  targets  on  military  ranges. 

In  the  development  of  MATILDA,  UK  PRA  modeling  experience  was  combined  with 
AFRL  expertise  in  development  of  complex  software  tools  for  laser  hazard  analysis  and 
laser  range  safety.  Initial  MATILDA  code  development  (2007-2012)  was  based  on  the  PRA 
“partition”  model  developed  to  perform  range  safety  clearances  for  the  UK  Thermal  Imaging 
Airborne  Laser  Designator  (TIALD)  system.  The  TIALD  model  “fault-free”  laser  hazard 
analysis  is  geometrically  similar  to  the  standard  risk  analysis  methods  currently  used  for 
laser  safety  clearances  on  U.S.  ranges.  However,  the  TIALD  model  contains  an  additional 
probabilistic  hazard  analysis  component,  which  assesses  probability  of  injury  to  an  unpro¬ 
tected  person  in  the  event  of  a  fault  or  failure  in  the  laser  directional  control  system.  The 
“UK  Laser  PRA  Model,”  described  m  Section  2,  refers  to  the  TIALD  model,  as  implemented 
in  MATILDA. 

The  MATILDA  system  is  a  new  software  tool  based  on  open-source  geographic  infor¬ 
mation  system  (GIS)  technology  that  integrates  relevant  laser  system  performance  param¬ 
eters  with  environmental  data  appropriate  to  the  range  location  where  the  system  is  being 
operated.  The  first  5-year  project  arrangement  (2007-2012)  to  develop  the  MATILDA  tool 
has  been  successfully  completed,  and  a  second  5-year  effort  (2012-2017)  is  currently  un¬ 
derway  to  produce  an  updated  version  with  enhanced  capabilities.  MATILDA  is  the  first 
military  software  tool  to  contain  a  complete  end-to-end  laser  PRA  model,  crafted  for  range 
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applications,  and  with  generalized  terrain  modeling.  In  the  future  it  will  provide  a  starting 
point  for  development  of  more  advanced  laser  PRA  models  and  tools. 


2.  UK  Laser  PRA  Model 

2.1 .  UK  need  for  a  PRA-based  approach 

The  primary  hazard  associated  with  low-to-moderate  power  lasers  is  potential  injury  to  ex¬ 
posed  tissue,  and  in  particular  the  eye.  While  protective  measures  can  be  applied  for  persons 
within  the  controlled  range  area  (CRA),  the  main  concern — particularly  in  the  case  of  air¬ 
borne  laser  target  designators  and  range  finders — is  avoidance  of  possible  ocular  injuiy  to 
unprotected  members  of  the  general  public,  should  laser  energy  escape  the  confines  of  the 
range.  Traditionally,  the  ocular  hazards  associated  with  a  laser’s  output  have  been  assessed 
in  terms  of  maximum  permissible  exposure,  from  which  a  corresponding  nominal  ocular 
hazard  distance  (NOHD)  is  determined.7-8  The  NOHD  represents  a  safe  viewing  distance  at 
which  an  observer  can  be  exposed  to  the  laser  energy  over  a  given  period  of  time  without 
risk  of  injury  to  the  eye.  Typical  exposure  periods  for  military  laser  systems  can  vary  from 
the  order  of  nanoseconds  (the  duration  of  a  single  Q-switched  laser  pulse)  to  as  long  as  10 
seconds  (for  a  stream  of  laser  pulses). 

Many  military  laser  systems  operate  at  wavelengths  within  the  near  infrared.  Of  these, 
1064-nm  radiation  is  particularly  hazardous  to  unprotected  eyesight,  due  to  the  transparency 
of  the  atmosphere  and  the  aqueous  media  at  that  wavelength.  Laser  energy  of  sufficient  in¬ 
tensity  at  1064  nm  can  cause  permanent  scarring  of  the  retina,  with  significant  loss  of  visual 
acuity.  The  NOHD  for  a  typical  airborne  laser  designator  emitting  at  1 064  nm  is  on  the 
order  of  tens  of  kilometers,  a  hazard  distance  that  might  be  substantially  increased  once 
correction  factors  for  magnifying  optics  and  atmospheric  propagation  are  taken  into  account. 
We  should  note  that  the  general  practice  in  UK  NOHD  calculations  is  to  include  a  correction 
factor  for  atmospheric  scintillation,  but  not  attenuation.  In  contrast,  U.S.  NOHD  calculations 
generally  include  correction  factors  for  atmospheric  attenuation,  but  not  scintillation. 

An  additional  consideration  in  the  hazard  assessment  is  the  angular  spread  over  which 
laser  energy  may  be  fired.  For  airborne  target  designators  and  range  finders  especially,  the 
wide  field  of  regard  of  the  laser  steering  mechanism,  relative  to  the  aircraft  velocity  vector, 
can  produce  a  risk  of  laser  energy  being  misdirected  outside  the  CRA.  A  nominal  hazard 
zone  can  be  defined  by  sweeping  the  applicable  NOHD  over  the  angular  range  of  possible 
directions  in  which  the  laser  could  be  fired.  It  is  necessary  to  implement  adequate  risk  man¬ 
agement  procedures  to  ensufe  that  airborne  military  lasers  with  significantly  large  hazard 
zones  can  be  operated  safely  within  the  context  of  an  outdoor  training  or  test  range.  For  a 
hazard  assessment  based  on  the  MPE,  such  a  requirement  can  be  satisfied  by  ensuring  either 
(a)  that  laser  energy  does  not  escape  the  CRA  under  any  circumstances  or  (b)  that  the  laser 
is  never  fired  when  an  uncontrolled  area  outside  the  range,  where  unprotected  persons  might 
be  present,  is  within  the  appropriate  NOHD.  '  -- 

Where  sufficient  real  estate  is  available,  it  is  possible  to  ensure  confinement  of  the 
hazard  zone  within  the  CRA  without  imposing  onerous  restrictions  on  the  permitted  laser 
firing  envelope.  In  such  cases,  the  laser  energy  is  said  to  have  been  “back-stopped”  within 
the  range.  U.S.  ranges  are  typically  large  enough  that  back-stopping  the  beam  is  feasible, 
with  the  correct  attack  track  and  firing  angle.  Training  ranges  within  the  UK,  however,  are 
generally  small  in  extent — of  the  order  of  a  few  kilometers  across — and  the  confined  ge- 
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ography  of  the  UK  means  that  training  ranges  are  never  very  far  from  populated  areas. 
Should  hazardous  levels  of  laser  energy  escape  the  confines  of  a  range  in  the  UK  for  any 
reason,  it  is  possible  that  an  unprotected  person  could  be  expoied  to  laser  irradiation  in 
excess  of  the  MPE.  In  such  cases  the  zero-risk  criterion,  implicit  in  standard  risk  analysis, 
creates  a  significant  problem  from  the  perspective  of  practical  laser  testing  and  training 
opportunities. 

While  the  NOHD  represents  an  appropriate  safe  exposure  distance,  the  MPE-criterion 
provides  no  quantitative  information  on  the  probable  risk  of  injury  for  unprotected  observers 
inside  the  NOHD  (i.e.,  in  the  hazard  zone).  Additionally,  a  strict  implementation  of  the  MPE 
safety  standard  across  the  entire  laser  field  of  regard  does  noUake  into  account  the  possible 
variation  in  the  risk  of  laser  energy  being  fired  in  any  given  direction.  With  a  well-designed 
and  properly  calibrated  laser  directional  control  system,  it  would  be  expected  that  most — 
if  not  all — of  the  laser  energy  will  be  reliably  incident  on  or  close  to  the  target.  In  most 
cases  then,  the  risk  of  laser  energy  escaping  the  CRA  will  be  small. 

With  the  relatively  small  size  of  UK  ranges,  the  stringent  limitations  on  the  laser  firing 
envelope,  required  to  satisfy  the  MPE  criterion,  could  totally  preclude  practical  testing  of, 
or  training  with,  airborne  laser  systems,  even  though  the  actual  risk  of  injury  may  be  neg¬ 
ligible.  This  implies  that  standard  MPE-based  risk  analysis  is  generally  too  inflexible  for 
UK  range  clearance  requirements.  Instead,  UK  range  clearance  models  are  probabilistic, 
and  based  on  the  principle  of  residual  risk  being  “as  low  as  reasonably  practicable” 
(ALARP). 14  The  use  of  the  ALARP  principle  in  UK  hazard  assessment  arises  from  the  pro¬ 
visions  of  the  UK  Health  and  Safety  at  Work  Act  of  1974. 15  Such  requirements  can  only  be 
satisfied  by  the  use  of  a  risk-based  approach  to  laser  hazard  assessment.  The  outcome  of 
such  a  risk-based  assessment  technique  is  a  risk  management  process  (see  Fig.  1)  by  which 
adverse  events,  and  the  inherent  uncertainties  with  which  they  occur,  can  be  rigorously  iden¬ 
tified  and  mitigated. 

Figure  1  provides  a  schematic  illustration  of  the  UK  risk  assessment  process,  which 
comprises  two  distinct  stages.  The  risk  analysis  stage  constitutes  a  hazard  assessment  of 
the  laser  system  performance  when  operating  either  as  intended,  or  in  the  event  of  a  laser 


RISK  ANALYSIS 


Fig.  1.  Laser  safety  risk  management  process. 
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sightime  directional  control  system  fault  or  failure.  The  laser  system  hazard  assessment  in 
the  UK  is  expressed  formally  in  a  laser  safety  paper  (LSP),  the  production  of  which  is  the 
responsibility  of  the  laser  system  project  authority.  The  probabilistic  range  clearance  model 
(PRCM)  provides  a  means  by  which  hazards  arising  from  the  laser  system  operation  can 
be  evaluated,  and  is  necessarily  based  on  the  performance  assessment  described  in  the  LSP. 
The  PRCM  represents  the  mathematical  implementation  of  the  “PE-Pj-P0D”  chain  of  ad¬ 
verse  risk— events  model.  An  illustration  of  the  P E— P j— -P qq  risk  chain  model,  in  a  general 
risk  modeling  context,  is  provided  in  Fig.  2  and  further  discussion  of  the  risk  chain  model 
is  provided  in  Section  2.2. 

The  hazard  assessment  for  the  laser  system  operation  is  the  subject  of  the  risk  man¬ 
agement  and  control  stage.  Laser-firing  restrictions  for  a  given  range,  target,  and  attack 
profile  combination  are  generated  by  application  of  the  PRCM,  as  encoded  in  the  MATILDA 
tool.  The  resulting  restrictions  on  the  permitted  laser  firing  envelope  may  then  be  evaluated 
in  context  of  other  (non-laser)  safety  information,  from  which  actual  laser  firing  restrictions 
can  be  derived  and  promulgated  to  the  system  operators  via  range  orders.  There  are  hence 
two  separate  hazard  assessments  encapsulated  in  Fig.  1 :  the  laser  system  hazard  assessment 
as  encapsulated  in  the  LSP  followed  by  the  operational  laser  hazard  assessment  as  effected 
by  the  PRCM  application. 
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Fig.  2.  “Pg-Pj-Pc©”  catastrophic  chain-of-events  model. 
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2.2.  A  risk-based  approach  to  laser  hazard  assessment 

T, 

The  risk  of  an  adverse  event,  such  as  a  laser-induced  ocular  injury  in  an  unprotected  popu¬ 
lation,  can  be  expressed  in  terms  of  a  “risk  chain”  comprising  three  main  components16:  (1) 
a  risk  source,  (2)  an  exposure  process,  and  (3)  a  causal  process  (see  Fig.  2).  In  the  case  of 
airborne  laser  operations,  the  risk  source  is  the  laser.  The  exposure  process  is  the  means  by 
which  laser  energy  from  an  airborne  platform  could  be  misdirected  outside  the  CRA,  caus¬ 
ing  an  unprotected  observer  to  be  irradiated.  The  causal  process  is  the  mechanism  by  which 
that  misdirected  laser  energy  could  cause  an  ocular  injury  to  the  unprotected  observer.  Un¬ 
certainty  persists  within  both  the  exposure  and  causal  professes  over  the  occurrence  of 
given  events,  such  as  the  misdirection  of  laser  energy  in  a  specific  direction  or  the  sustaining 
of  an  ocular  injury. 

Typically,  the  hazard  posed  by  a  risk  event  can  be  defined  by  the  likeliness  of  its  oc¬ 
currence  and  its  consequent  impact.16  The  likeliness  of  an  adverse  event  can  be  defined  in 
terms  of  the  frequency  or  probability  with  which  it  occurs.  The  impact  of  a  given  event  de¬ 
pends  on  the  extent  to  which  the  consequences  of  that  event  affect  the  system  under  con¬ 
sideration.  In  the  case  of  an  ocular  injury,  the  impact  can  vary  from  minimal  impact  on 
visual  acuity  to  a  total  loss  of  visual  function.  The  bivariate  relationship  between  likeliness 
and  impact  can  be  expressed  in  terms  of  a  simple  “quadrant”  risk  model,  as  illustrated  in 


Fig.  3.  In  this  simple  model,  an  adverse  event  can  occur  with  (1)  a  high  likeliness  but  low 
impact,  (2)  high  likeliness  and  high  impact,  (3)  low  likeliness  and  high  impact,  or  (4)  low 
likeliness  and  low  impact. 


The  purpose  of  the  ALARP  principle  is 
to  identify  and  implement  suitable  risk  man¬ 
agement  control  procedures  so  as  to  ensure 
that  any  potentially  adverse  events  occur  only 
with  a  low  likeliness  and  low  impact.  An  im¬ 
portant  aspect  of  the  risk-based  approach  is  a 
suitable  definition  of  what  constitutes  a  low 
likeliness  and  low  impact  event.  The  UK  risk- 
based  range  clearance  model  is  based  prima¬ 
rily  on  a  probabilistic  laser  pointing  error 
model  (the  exposure  process)  coupled  with  a 
probabilistic  ocular  damage  model  for  1064- 
nm  laser  energy  (the  causal  process). 


Fig.  3.  Risk  quadrant  for  an  adverse  event. 


2.3.  Probabilistic  laser  pointing  error  modeling 

The  goal  of  probabilistic  pointing  error  modeling  is  to  identify  a  pointing  error  probability 
distribution  function  (PDF),  which  quantifies  the  probability  of  laser  energy  being  fired  in 
any  given  direction.  Clearly  this  function  will  vary,  depending  on  the  characteristics  of  the 
laser  system  and  supporting  aircraft  being  modeled.  The  UK  probabilistic  laser  pointing 
error  model  addresses  two  separate  regimes:  (1)  a  “fault- free”  regime,  when  the  directional 
control  system  is  operating  as  intended  against  a  distinct  well-defined  target,  and  (2)  a 
“fault/failure”  regime,  which  covers  situations  when  the  directional  control  system  fails  to 
operate  as  intended.  The  latter  might  occur  either  as  a  result  of  an  actual  electro-mechanical 


Journal  of  Directed  Energy ,  5,  Fall  2014 


244 


FLEMMING  ETAL. 


failure,  or  due  to  a  failure  of  the  system  to  maintain  the  laser  sightime  alignment  on  the  tar¬ 
get,  such  as  during  rough  weather,  when  the  aircraft  is  an  unstable  platform. 

Modeling  of  the  fault/failure  condition  is  an  important  feature  of  the  UK’s  risk-based 
range  clearance  technique.  A  significant  parameter  is  the  probability,  PF,  of  a  laser  system 
fault  or  failure  occurring  during  the  course  of  a  laser  firing  maneuver,  which  is  expected  to 
be  low  for  a  modem,  well-maintained  system.  A  suitable  value  for  the  probability  of  system 
fault  or  failure  can  be  established  using  appropriate  fault  or  failure  data,  including  mean- 
time-between-failure  (MTBF)  statistics.  It  should  be  noted  that  the  fault/failure  condition 
covers  only  accidental  or  unintended  laser  pointing  errors,  and  not  deliberate  firing  of  the 
laser  outside  the  CRA.  It  is  assumed  and  required  that  appropriate  steps  are  taken  to  disable 
laser  firing  immediately  after  a  fault  or  failure  has  occurred,  whether  manually  by  the 
weapon  systems  operator  (WSO)  or  automatically  by  built-in  fault  detection  mechanisms. 
Consequently,  it  is  expected  that  only  a  small  amount  of  laser  energy  would  potentially  es¬ 
cape  the  confines  of  the  CRA  before  laser  firing  ceases. 

As  mentioned,  the  definition  of  an  appropriate  PDF,  which  covers  the  fault/failure  con¬ 
dition,  is  dependent  on  the  aircraft-laser  system  architecture.  In  particular,  the  maximum 
angular  drift,  @max,  of  a  sightline  error  while  the  laser  is  still  active  will  generally  be  a  func¬ 
tion  of  system  design  and  WSO  reaction  time.  In  the  absence  of  suitable  statistical  data,  an 
appropriate  distribution  function  for  laser  directional  errors  in  fault/failure  condition  can 
be  established  through  the  use  of  simulation  modeling.  MTBF  data  are  used,  in  conjunction 
with  a  simplified  “onion-skin”  model  (see  Fig.  4),  to  simulate  the  behavior  of  the  laser  sight¬ 
line  following  a  fault  or  a  failure  in  different  parts  of  the  airborne  laser  designator  control 
system. 

The  distribution  of  laser  pointing  errors  in  a  fault/failure  condition  depends  on  the  laser 
system  design  and  the  consequences  of  any  faults  or  failures  that  could  occur  in  the  direc¬ 
tional  control  mechanism,  all  of  which  should  be  described  in  the  LSP.  Examples  of  direc¬ 
tional  control  system  failures  include:  a  steering  gimbals  runaway,  in  which  the  laser 
sightline  could  be  driven  rapidly  away  from  the  target  position,  and  a  steering  gimbals 
freeze,  in  which  the  laser  sightline  direction  will  depend  on  the  aircraft  motion  relative  to 
the  target.  Another  possibility,  depending  again  on  laser  system  design,  could  involve  ec- 


Fig.  4.  SELEX  ES  “onion-skin”  fault/failure  condition  model. 
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centric  cycling  of  the  laser  sightime  about  the  target  as  a  result  of  a  partial  failure  in  the  di¬ 
rectional  control  system.  The  choice  of  statistical  distribution  representing  errant  laser  sight¬ 
line  behavior  is  hence  dependent  on  system  design  characteristics,  together  with  the  quality 
of  information  available  for  analysis.  Statistical  functions  that  have  historically  been  used 
to  describe  simple  fault  pointing  error  models  (and  which  are  or  can  be  encoded  in 
MATILDA)  include  the  uniform,  triangular,  and  exponential  distributions.  More  sophisti¬ 
cated  analyses  could  alternatively  be  developed,  depending  on  available  resources  and  the 
economic  justification  for  doing  so. 

Fault-free  laser  pointing  errors  are  typically  described  using  a  bivariate  normal  distribution, 
defined  either  in  local  azimuth  and  elevation  or  local  polar  coordinates.  An  important  parameter 
is  the  fault-free  “root-mean-square”  statistic,  a,  which  quantifies  the  statistical  spread  in  laser 
pointing  errors  and  which  can  be  derived  experimentally,  using  appropriate  measurement  data, 
from  development  trials  conducted  under  representative  conditions.  Another  important  param¬ 
eter  in  the  UK  model  is  a  “maximum  fault-free  error,”  amax,  such  that  the  probability  of  an  ex¬ 
cessively  large  directional  control  error  is  small.  Typically,  the  value  of  amax  will  be  a  function 
of  PF  and  <r  and,  as  such,  can  be  considered  a  threshold  between  normally  distributed  fault- 
free  laser  pointing  errors  and  fault/failure-condition  laser  sightline  errors. 


2.4.  Probabilistic  ocular  damage  modeling 

The  MATILDA  tool  currently  uses  the  UK  probabilistic  ocular  damage  model,  for  1064- 
nm  laser  energy,  to  assess  the  probability  of  injury  for  unprotected  persons  inadvertently 
exposed  to  stray  laser  radiation.  The  model  is  based  on  an  experimentally  derived  log-nor¬ 
mal  distribution  relating  total  intraocular  (laser)  energy  (TIE)  with  the  probability  of  causing 
a  minimum  ophthalmoscopically  visible  lesion  (MOVL).3  The  UK  probabilistic  ocular  dam¬ 
age  model  has  also  been  combined  mathematically  with  a  probabilistic  scintillation  model 
that  predicts  a  log-normal  distribution  for  the  multiplicative  gain  in  laser  energy  density  as 
a  result  of  turbulence-induced,  atmospheric  scintillation  effects. 

For  purposes  of  the  UK  probabilistic  model,  a  MOVL  is  defined  as  a  retinal  lesion  of 
30-um  diameter,  assuming  unaided  viewing  of  the  laser  energy.  The  rationale  behind  this 
size  of  lesion  is  that:  (1)  it  is  practically  the  smallest  lesion  size  that  can  be  detected  nonin- 
vasively  using  an  ophthalmoscope,  and  (2)  it  is  considered  impractical  for  an  infrared  image 
smaller  than  30  um  to  be  formed  on  the  retina,  owing  to  the  limitations  of  the  human  eye  in 
imaging  a  distant  infrared  laser  source.  In  the  case  of  aided  viewing  of  the  laser  source  with 
magnifying  optics,  it  is  expected  that  the  diameter  of  any  laser  image  on  the  retina  would 
be  generally  larger  than  the  corresponding  unaided  image.  Consequently,  for  aided  viewing 
of  the  laser  source,  the  MOVL  diameter  is  increased  to  a  value  of  90  um. 

An  observer  sustaining  a  MOVL  on  the  most  sensitive  part  of  the  retina  (the  fovea)  could 
experience  a  minor  but  permanent  impairment  of  visual  acuity,  such  as  difficulty  in  reading 
fine  print.  A  MOVL  occurring  on  any  other  part  of  the  retina,  such  as  the  macula  or  para- 
macula,  may  have  even  less  effect  on  visual  acuity.  Given  other  (even  naturally  occurring) 
conditions  that  could  seriously  affect  visual  acuity,  up  to  and  including  total  blindness,  the 
effect  of  a  MOVL  can  be  considered  to  be  a  low-impact  event. 

It  should  be  mentioned  that  probabilistic  ocular  damage  models  have  also  been  devel¬ 
oped  independently  by  the  United  States  (AFRL).  These  are  “dose-response”  models  that 
give  the  probability  of  causing  a  MOVL  (response)  as  a  function  of  exposure  level  (dose) 
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for  1064  nm17  and  1315  nm18  laser  radiation.  Unlike  the  UK  model,  however,  scintillation 
effects  are  not  included  in  calculating  the  dose.  The  current  plan  is  to  include  these  U.S. 
ocular  damage  models  in  more  advanced  versions  of  MATILDA,  with  the  user  given  the 
option  of  choosing  the  appropriate  model  for  their  particular  range  and  training  scenario. 


2.5.  UK  expectation  model 

For  airborne  laser  operations,  the  risk  of  ocular  injury  to  unprotected  persons  can  be  char¬ 
acterized  as  the  probability  that  a  “catastrophic  chain  of  events,”  leading  to  an  adverse  out¬ 
come,  will  occur.  The  three  main  components  of  such  a  “cascade”  risk  are:  (1)  the 
probability  of  laser  energy  being  fired  in  an  inappropriate  direction  outside  the  CRA  (PE), 

(2)  the  probability  of  an  unprotected  observer  being  irradiated  by  the  laser  energy  (Pj),  and 

(3)  the  subsequent  probability  of  the  irradiated  observer  sustaining  an  ocular  injury  (P0D). 
This  “PE-PrP0D”  structure  provides  the  mathematical  basis  for  the  UK  probabilistic  laser 
hazard  assessment  (see  Fig.  2). 

The  UK  probabilistic  hazard  assessment  model,  or  expectation  model,  is  based  on  an 
evaluation  of  the  expected  number  of  unprotected  observers  who  sustain  a  MOVL  during 
an  airborne  laser  firing  maneuver,  a  quantity  defined  as  EM0VL.  The  primary  criterion  for 
clearance  of  a  laser  firing  maneuver  is  that  the  expected  number  of  cases  of  MOVL  does 
not  exceed  a  predefined  maximum  acceptable  value,  EM0VLMAX.  The  primary  criterion  takes 
into  account  both  the  likeliness  of  laser  energy  being  misdirected  outside  the  CRA  and  the 
potential  consequences  of  an  unprotected  observer  being  irradiated.  In  addition,  two  pre¬ 
cautions  are  also  implemented  in  the  expectation  model:  to  guard  against  the  possibility  of 
a  low-likeliness,  high-impact  event,  in  which  a  high  probability  of  ocular  damage  to  an  ir¬ 
radiated  observer  could  be  masked  by  a  low  frequency  of  occurrence. 

The  secondary  precaution  evaluates  the  expected  hazard  for  a  scenario  in  which  it  is 
assumed  that  laser  energy  is  misdirected  toward  a  populated  area  outside  the  CRA.  The  ac¬ 
ceptable  criterion  for  the  secondary  precaution  is  that — should  laser  energy  be  inadvertently 
misdirected  outside  the  CRA — the  expected  number  of  cases  of  MOVL  does  not  exceed  a 
predefined  maximum  value,  EC0NMAX.  Finally,  the  tertiary  precaution  assumes  that  an  un¬ 
protected  observer  has  actually  been  irradiated  by  a  single  pulse  of  laser  energy.  The  ac¬ 
ceptable  criterion  for  the  tertiary  precaution  is  that  the  probability  of  a  MOVL  for  an 
irradiated  individual  does  not  exceed  a  predefined  maximum  value,  EMqvlmax- 

Appropriate  restrictions  are  imposed  on  the  laser  firing  envelope  to  ensure  that  the  pri¬ 
mary  criterion,  secondary^precaution,  and  tertiary  precaution,  are  all  satisfied.  The  effect  of 
the  tertiary  precaution.^  to  impose  a  probabilistically  defined  minimum  separation  distance 
(MSD)  between  the  laser  and  any  unprotected  observer  outside  the  CRA.  The  MSD  is  ap¬ 
plied  in  all  directions  in  which  the  laser  could  be  fired  before  the  laser  operation  is  inhibited, 
either  automatically  by  the  laser  system  itself  or  manually  by  the  operator.  In  this  respect, 
the  MSD  is  similar  to  the  NOHD,  albeit  much  smaller  in  magnitude.  An  unprotected  ob¬ 
server  located  at  the  MSD  from  the  laser  would  be  at  a  non- zero  risk  of  sustaining  a  given 
measureable  level  of  ocular  damage,  if  irradiated.  The  role  of  the  MSD  is  similar  to  that  of 
a  seat  belt  in  a  car^  The  purpose  of  a  vehicle  seat  belt  is  to  provide  the  occupant  with  a 
degree  of  protection  against  the  possibility  of  a  more  serious  injury  in  the  event  of  an  acci¬ 
dent:  its  primary  role  is  to  mitigate  the  possible  consequences  of  an  accident  to  an  individual 
rather  than  provide  total  protection  against  injury  or  death.  In  a  similar  manner,  the  purpose 
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of  the  MSD  is  to  ensure  against  the  possibility  of  more  serious  levels  of  ocular  damage 
should  an  individual  observer  be  irradiated. 

1 . 

2.6.  UK  partition  model 

’The  UK  partition  model  is  a  specific  implementation  of  the  expectation  model  described 
above,  in  which  the  hazard  contributions  arising  from  fault-free  and  fault/failure  operation 
of  the  laser  directional  control  system  are  evaluated  separately.  The  overall  clearance  re¬ 
strictions  defining  the  permitted  laser  firing  envelope  are  a  composite  of  the  separately  eval¬ 
uated  restrictions  for  fault-free  and  fault/failure  operation.  As  mentioned  previously,  the 
partition  model  described  here,  and  used  in  the  MATILDA'lool,  was  developed  to  perform 
range  safety  clearances  for  the  UK  TIALD  system. 

Fault-free  laser  firing  zones  (FFLFZ)  are  geometric  areas  within  which  an  aircraft  fly¬ 
ing  at  a  designated  altitude  can  fire  freely  at  the  target.  FFLFZ  are  defined  in  such  a  way 
that  all  fault-free  laser  pointing  errors  (errors  less  than  amax)  produce  laser  beams  that  fall 
within  the  CRA.  Typically,  the  FFLFZ  are  evaluated  for  all  compass  directions  around  the 
target,  and  over  a  range  of  aircraft  altitudes,  in  accordance  with  laser  system  user  require¬ 
ments.  Each  designated  aircraft  altitude  produces  a  different  FFLFZ.  The  geometry  of  the 
FFLFZ  calculation  is  similar  to  the  standard  risk  analysis  methods  currently  used  by  the 
USAF  to  establish  a  safe  laser  firing  envelope. 10  However,  the  FFLFZ  calculation  is  de¬ 
signed  to  maximize  the  range-to-target  at  which  the  laser  can  be  fired,  given  the  extent  of 
CRA  available. 

The  hazard  analysis  for  fault/failure  operation  is  the  fully  probabilistic  portion  of  the 
overall  laser  hazard  assessment.  It  follows  computation  of  the  FFLFZ,  considers  laser  point¬ 
ing  errors  in  excess  of  «max,  and  is  only  performed  for  specific  laser  firing  maneuvers  on 
specific  aircraft  attack  tracks.  Thus,  the  first  step  in  the  fault  hazard  analysis  is  to  define  the 
aircraft  attack  track,  attack  altitude,  and  laser  firing  positions.  A  check  is  then  made  to  ensure 
that  the  attack  scenario  complies  with  FFLFZ  restrictions.  Any  laser  firing  maneuvers  that 
do  not  comply  with  FFLFZ  restrictions  are  eliminated  prior  to  the  fault  hazard  analysis. 

The  probabilistic  laser  pointing  error  model  and  probabilistic  ocular  damage  model  are 
used  in  the  fault  hazard  analysis  to  evaluate  EMOVL,  and  this  is  compared  to  the  maximum 
acceptable  value,  EM0VI  MAX,  to  determine  whether  the  specified  laser  firing  maneuver  meets 
the  primary  criterion  for  safety  clearance.  A  typical  maximum  acceptable  expectation  value 
for  UK  range  clearances  is  10"8  occurrences  of  MOVL  per  attack.  In  comparison,  a  typical 
NASA  acceptable  expectation  value  for  injury  by  falling  inert  debris  is  1 0"6  injuries  per 
launch.  If  the  primary  criterion  is  met,  then  the  secondary  and  tertiary  precautions  are  ap¬ 
plied,  to  identify  any  additional  restrictions  on  the  laser  firing  envelope. 

The  partition  model  is  a  means  by  which  the  conditional  expectation  of  a  MOVL  in 
an  unprotected  population  can  be  evaluated,  and  appropriate  laser  firing  restrictions  de¬ 
fined,  such  that  risks  produced  by  a  specified  laser  firing  maneuver  are  kept  within  ac¬ 
ceptable  limits.  In  terms  of  the  quadrant  risk  model  (Fig.  3),  the  FFLFZ  ensures  that  all 
high  likeliness  events,  whether  of  high  or  low  impact,  are  contained  within  the  controlled 
range  area.  Furthermore,  the  subsequent  fault  hazard  analysis  ensures  that  appropriate  ad¬ 
ditional  restrictions  are  defined  to  avoid  the  occurrence  of  low  likeliness,  but  potentially 
high  impact  events.  In  this  respect,  the  partition/expectation  model  satisfies  the  ALARP 
requirement. 
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2.7.  Computational  model 

The  partition/expectation  model  is  implemented  by  means  of  the  computational  model,  from 
which  the  applicable  laser  firing  restrictions  are  derived.  The  computational  model  is  com¬ 
posed  of  three  main  modules,  executed  sequentially,  called  RJBPROG,  CALCZONE,  and 
CALCFAULT.  In  these  modules  input  data  required  for  the  hazard  assessment — such  as 
range  boundaries,  terrain  elevation  data,  target  position  on  the  range,  local  demographics, 
local  geography  near  the  range,  and  aircraft  and  laser  system  parameters — are  first  specified. 
Appropriate  preliminary  computations,  including  definition  of  the  CRA,  are  then  performed, 
followed  by  the  execution  of  the  partition  model  as  described  above. 

The  initial  module  is  the  range  boundary  program,  known  as  RBPROG  for  short.  The 
main  purpose  of  the  RBPROG  algorithm  is  to  define  the  CRA,  which  will  be  used  in  the 
CALCZONE  module  to  define  the  FFLFZ.  The  CRA  is  a  subset  of  the  total  range  area, 
which  is  “star-shaped”  with  respect  to  a  given  target.  A  CRA  is  defined  to  be  star-shaped 
when  any  radial,  co,  emanating  from  the  target,  crosses  the  range  boundary  only  once.  Fre¬ 
quently  the  initial  range  area  does  not  satisfy  the  star-shaped  condition,  so  a  portion  of  it 
is  truncated  to  form  the  star-shaped  CRA.  Extra  coordinates  are  also  inserted  around  the 
modified  CRA  boundary  to  provide  appropriate  computation  points  for  the  CALCZONE 
algorithm. 

The  second  module,  CALCZONE,  performs  the  fault-free  laser  hazard  analysis.  Specif¬ 
ically,  it  calculates  the  FFLFZ  for  each  designated  target  within  the  CRA,  and  for  each  des¬ 
ignated  aircraft  altitude.  The  definition  of  an  FFLFZ  begins  with  a  set  of  radials  connecting 
the  target  to  each  of  the  CRA  boundary  points.  For  each  radial,  co,  emanating  from  the  target, 
CALCZONE  computes  a  maximum  laser  firing  range-to-target  (ground  range),  R(co),  such 
that  fault-free  laser  pointing  errors  (within  «max  of  the  laser-target  vector)  remain  within 
the  CRA.  This  requirement  results  in  two  such  ranges-to-target,  Ru(co)  and  R0(co),  corre¬ 
sponding  to  the  need  to  keep  “undershoot”  and  “overshoot”  laser  pointing  errors,  respec¬ 
tively,  within  the  CRA,  as  shown  in  Fig.  5.  We  should  note  that  azimuth  errors  are  generally 
not  significant  compared  to  elevation  (i.e.,  undershoot  or  overshoot)  errors.  We  should  also 
note  that  Fig.  5  shows  the  aircraft  firing  when  not  directly  over  the  range,  something  not 
usually  done  during  U.S.  laser  range  tests.  This  is  allowed  under  UK  laser  safety  policy, 
due  to  their  small  ranges,  but  only  on  fixed  approaches  and  at  fixed  heights,  as  indicated  by 
the  fault-free  laser  firing  aones  (FFLFZ). 

The  applicable  maximum  range-to-target,  R(co),  at  which  the  laser  may  be  fired  is  taken 
to  be  the  smaller  of  the  undershoot  and  overshoot  ranges;  that  is,  R(co)  =  min{Ru(co),  Rg 
(m)}.  Since  the  firing  angle  to  the  target  will  vary  with  aircraft  height  (or  altitude),  h,  a  dif¬ 
ferent  set  of  maximum  firirlg  ranges  will  be  obtained  for  each  designated  aircraft  altitude. 
The  FFLFZ  for  each  aircraft  altitude  can  then  be  defined  as  the  set  (f?(<a):  toe  [0,2rc)}.  For 
any  aircraft  maneuver,  at  any  given  altitude,  the  FFLFZ  defines  the  maximum  range-to-tar¬ 
get  at  which  the  laser  may  be  fired,  assuming  fault-free  operation  of  the  laser  directional 
control  system. 

The  third  module,  CALCFAULT,  performs  the  probabilistic  fault/failure  hazard  analysis, 
for  a  specific  laser  attack  scenario  to  determine  if  any  additional  restrictions  must  be  im¬ 
posed  on  the  laser  firing  envelope  permitted  by  the  FFLFZ.  As  mentioned  previously,  the 
first  step  in  the  fault  hazard  analysis  is  to  define  the  aircraft  attack  track,  altitude,  and  laser 
firing  positions.  A  check  is  then  made  to  ensure  that  the  laser  attack  scenario  complies  with 
FFLFZ  restrictions  and  any  laser  firing  maneuvers  that  do  not  comply  are  eliminated. 
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Fig.  5.  Fault-free  overshoot  and  undershoot. 

For  each  laser  pulse  fired  during  the  course  of  the  specified  laser  attack  scenario,  the 
CALCFAULT  algorithm  evaluates  a  corresponding  expectation  value,  eM0VL,  that  a  MOVL 
will  occur  in  the  unprotected  population  surrounding  the  CRA.  The  number  of  pulses  emit¬ 
ted  after  a  fault  or  failure  has  occurred  depends  on  the  pulse  repetition  frequency  and  the 
length  of  time  required  for  the  laser  to  cease  firing.  Consequently,  the  overall  expectation 
value,  Emovl,  of  MOVL  occurring  in  the  unprotected  population,  is  the  sum  of  the  mdivid- ' 
ual  (pulse-based)  eM0VL  values  for  the  period  of  time  during  which  the  laser  continues  to 
fire,  and  before  laser  firing  is  inhibited. 

Restrictions  on  laser  firing  are  subsequently  imposed  on  those  portions  of  the  aircraft 
maneuver  for  which  the  calculated  value  of  Emovl  exceeds  the  acceptable  limit.  Additional 
laser  firing  restrictions  may  also  be  imposed  on  those  portions  of  the  aircraft  maneuver  that 
bring  the  laser  to  within  the  applicable  MSD  of  potentially  vulnerable  populated  areas.  The 
computational  model  requires  a  significant  amount  of  geographic  and  demographic  data  in 
order  to  compute  an  optimum  set  of  restrictions  for  any  given  laser  firing  operation  during 
a  training  maneuver.  The  MATILDA  tool  is  designed  to  provide  a  suitable  software  platform 
for  performing  these  calculations  and  displaying  the  results,  based  on  geographic  informa¬ 
tion  system  technology  tailored  to  the  needs  of  airborne  military  laser  hazard  assessment. 

3.  The  MATILDA  Tool 

3.1 .  Genesis  of  MATILDA 

During  the  early  1990s,  the  USAF  identified  the  need  for  an  automated  software  tool  to  aid 
range  safety  officers  in  establishing  laser  range  safety  clearances.  The  result  was  the  Laser 
Range  Management  Software  (LRMS)  tool,  which  the  USAF’s  Optical  Radiation  Safety 
team  has  used  for  nearly  two  decades  to  establish  MPE-based  range  safety  clearances  for 
all  USAF  active  ranges.  During  the  late  1990s,  the  USAF  began  attempts  to  understand  the 
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safety  implications  of  developing  high  energy  laser  systems.  Initial  developments  followed 
the  accepted  standard  risk  analysis  approach,  but  it  was  recognized  by  AFRL  that  eventually 
a  PRA-based  tool  would  be  necessary  to  deal  with  HEL  hazard  analysis  in  support  of  range 
testing,  training,  and  operational  deployment.  It  was  at  this  time  that  discussions  with  the 
UK  MoD  began,  with  the  goal  of  leveraging  their  laser  PRA  modeling  capabilities. 

Early  discussions  focused  on  each  organization’s  respective  methodologies  for  laser 
safety  and  hazard  analysis.  After  consideration,  it  was  agreed  that  the  best  way  to  clarify 
U.S.  understanding  of  the  UK  PRA-based  approach  was  to  actually  implement  one  of  the 
existing  UK  models,  using  AFRL  expertise  in  development  of  advanced  software  tools  for 
laser  hazard  analysis.  By  approaching  the  collaboration  in  this  manner,  the  USAF  has  real¬ 
ized  its  goal  of  understanding  UK  methodology,  and  the  UK  has  realized  its  goal  of  obtain¬ 
ing  an  integrated  version  of  their  laser  PRA  analysis  methodology  in  a  single  analytical 
tool.  It  was  decided  that  the  best  candidate  for  this  effort  would  be  the  PRA  partition  model 
for  the  UK  Thermal  Imaging  Airborne  Laser  Designator  (TIALD)  system.  The  UK  also 
suggested  that  the  new  software  be  called  the  Military  Advanced  Technology  Integrated 
Laser  Hazard  Assessment  (MATILDA)  tool. 

3.2.  MATILDA  development  and  testing 

The  UK  MoD’s  TIALD  model  consisted  of  several  HP  BASIC  programs  that  had  been  de¬ 
veloped  and  refined  over  many  years.  Each  program  was  a  stand-alone  code  whose  results 
were  manually  fed  to  the  next  program  in  the  analysis  chain.  Geographic  input  data  were 
manually  extracted  from  British  Ordnance  Survey  maps.  Although  an  independent  imple¬ 
mentation  of  TIALD  model  algorithms  has  been  created  in  MATILDA,  the  results  of  these 
original  codes  have  proven  valuable  as  a  cross-check  on  MATILDA  results. 

During  MATILDA  development,  the  UK  MoD  has  supplied  the  mathematical  models, 
algorithms,  and  corresponding  documentation,  while  the  USAF  has  been  the  primary  software 
developer.  A  lesson  learned  from  earlier  generations  of  laser  codes  was  to  encapsulate  com¬ 
putational  logic/code  into  a  nonproprietary  language  to  avoid  continuous  porting  of  the  code 
to  the  latest  fad  in  software  tools.  FORTRAN  has  long  been  that  language  but  has  been  losing 
ground  to  C  and  C++  over  the  last  couple  of  decades,  Thus,  MATELDALib  is  an  ANSI  C++ 
library  that  encapsulates  all  of  the  computational  code  and  logic  required  of  RBPROG,  CALC- 
ZONE,  and  CALCFAULT.  Using  C/C++  provides  MATELDALib  the  speed  advantages  in¬ 
herent  in  C/C++  codes  while  also  providing  portability  to  most  modem  computing  platforms. 

Although  MATILDA  started  out  as  a  computational  tool,  and  retains  a  computational 
focus,  the  need  to  display  thhresults  graphically  became  readily  apparent  during  the  initial 
implementation  of  the  RBPROG  algorithms.  The  original  HP  BASIC  codes  implemented 
a  scaled  version  of  the  British  National  Grid  Coordinate  system.  Early  discussions  between 
the  UK  MoD  and  USAF  had  already  emphasized  the  need  to  leverage  standard  geographic 
information  system  (GIS)  formats;  however,  budgets  on  both  sides  were  limited.  Fortunately 
for  us,  the  Idaho  State  University  (ISU)  Geospatial  Software  Lab  (GSL)  had  similar  con-  , 
straints  several  years  earlier,  when  they  launched  the  Map  Window  Open  Source  develop¬ 
ment  effort.  After  a  quick  study  of  the  ISU  GSL  capabilities,  it  was  decided  that  MATILDA 
should  consist  of  a  set  of  plug-ins  to  Map  Window. 

The  MATILDA  development  team  has  made  a  concerted  effort  to  keep  the  computa¬ 
tional  engine  of  the  tool,  MATILDALib  ANSI  C++,  completely  independent  of  the  Map- 
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Window  code.  Separating  the  graphics  user  interface  (GUI)  from  the  computational  engine 
has  a  number  of  advantages.  It  simplifies  coding,  debugging,  and  updates  of  the  different 
modules  of  the  tool,  enhances  portability  to  different  platforms,  and  attlows  MATILDALib 
to  be  leveraged  by  any  GIS  application/system.  This  is  important  because,  just  as  the 
MATILDA  project  has  leveraged  Map  Window  efforts,  future  PRA  applications  will  be  able 
to  leverage  the  MATILDA  effort. 

Due  to  the  diverse  requirements  for  generating  range  clearance  information,  it  was 
agreed  that  there  should  actually  be  three  different  versions  of  MATILDA.  The  first 
(MATILDA  User)  would  be  for  basic  users  to  simply  determine  whether  a  particular  mission 
was  allowed,  based  on  an  established  range  clearance,  and  with  little  or  no  ability  to  change 
any  of  the  previously  verified  and  tested  input  parameters.  The  second  (MATILDA  User 
Plus)  would  be  for  more  advanced  users  at  the  range  to  incorporate  limited  changes  to  the 
target  position  and  attack  track.  The  third  (MATILDA  Pro)  would  be  the  full  model  for  ex¬ 
pert  analysts  responsible  for  setting  the  parameters  needed  for  the  range  safety  analysis  and 
then  performing  the  analysis  to  establish  the  initial  range  clearance. 


3,3.  Sample  MATILDA  analysis 


As  a  demonstration  of  code  capabilities,  we  used  the  MATILDA  Pro  version  to  perform  a 
sample  hazard  analysis  for  a  hypothetical  airborne  laser  designator  used  in  an  attack  ma¬ 
neuver  during  a  range  training  scenario.  It  is  assumed  that  the  laser  designator  is  an  “all¬ 
round  line-of-sight”  system  mounted  on  a  single-seat  strike  aircraft.  First  an  analysis  of  the 
laser  output  during  the  attack  maneuver  must  be  carried  out.  Typically,  the  laser  will  be 
fired  in  short  bursts  of  a  few  seconds  duration  at  different  points  on  the  attack  track. 

Important  parameters  for  the  laser  hazard  analysis  include:  (1)  details  of  the  pulse  energy, 
peak  irradiance,  and  beam  energy  distribution,  which  may  change  considerably  during  the 
course  of  the  attack  maneuver  as  the  laser  warms  up  or  cools  down;  (2)  other  key  beam  pa¬ 


rameters  such  as  wavelength,  beam 
divergence,  pulse  duration,  and  pulse 
repetition  frequency;  (3)  fault-free 
and  fault  pointing  error  distributions; 
and  (4)  the  probability  of  fault  for 
the  laser  system.  These  laser  system 
parameters  are  obtained  by  the  laser 
system  manufacturer  through  testing 
of  multiple  laser  units  and  averaging 
of  performance  data.  The  data  are 
provided  to  laser  safety  officers  in 
the  laser  safety  paper  (LSP)  de¬ 
scribed  in  Section  2.1.  The  LSP  is 
compiled  by  the  laser  system  project 
authority  and  represents  the  laser 
system  hazard  assessment.  Hypo¬ 
thetical  laser  system  parameters  for 
input  into  MATILDA  are  summa¬ 
rized  in  Table  1 . 


Table  1.  Input  Parameters  for  Hypothetical 
Airborne  Laser  Designator 


Parameter 

Parameter 

Value 

Fault-free  pointing  error  distribution 

Gaussian 

Fault-free  RMS  pointing  error 

5  mrad 

Fault  pointing  error  distribution 

Uniform 

Maximum  fault  pointing  error 

0.35  rad  (20  deg) 

Probability  of  fault 

10"' per  attack 

Laser  switch-off  time  in  fault  condition 

3  seconds 

Laser  wavelength 

1064  nm 

Pulse  energy 

200  mJ 

Beam  divergence 

0.124  mrad 

Pulse  duration 

10  ns 

Pulse  repetition  frequency 

20  Hz 
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In  addition  to  laser  system  param¬ 
eters,  MATILDA  also  requires  a  great 
deal  of  geometric  and  geographic  input 
data  such  as  range  boundaries,  terrain 
mapping  data,  terrain  elevation  data, 
target  position  on  the  range,  location 
of  urban  areas,  and  local  geography 
near  the  range.  Geometric  inputs  of 
this  kind  are  represented  visually  by 
shapes  on  layers  loaded  by  the  analyst, 
as  shown  in  Fig.  6.  Once  all  necessary 
input  data  have  been  entered,  the  three 
main  modules— RBPROG,  CALC- 
ZONE,  and  CALCFAULT — are  exe¬ 
cuted  sequentially. 


Fig.  6.  MATILDA  Pro  primary  geographic  inputs. 


3.4.  RBPROG  analysis 

1^70^71  f  “  m°dule  "  t0  define  a  CRA  suitable  for  use  in  the 
CZONE  module.  A  suitable  CRA  is  defined  to  be  a  subset  of  the  total  range  area  that 

crosses' the^CR T**  1  ^  ^  ** iS’  any  radial  emanatin§  from  the  target 
crosses  the  CRA  boundary  only  once.  The  RBPROG  analysis  achieves  this  result  via  six 

steps:  (1)  the  star-shaped”  condition,  (2)  the  “points  of  approach”  condition,  (3)  the  “ter- 

Ind  %Uh  “I  t"’ (4)  the  UUrb3n  area”  condition’  (5) the  “small  increment”  condition 
and  (6)  the  undershoot/overshoot”  condition. 

The  star-shaped  condition  establishes  the  suitability  of  the  CRA  boundary  for  the  an- 

p  ,c,  of  the  CALCZONE  module.  Essen, ially,  toe  ^-shaped  eondi.ion  e«IT. 

radial  from  the  target  position  crosses  the  CRA  boundary  once  only.  The  points  of  approach 

nail  ofTeCRAh811  H°  f  ^  d°SeSt  P°mt  t0  the  tarSet  on  a  line  segment  making  up 
part  of  the  CRA  boundary,  so  that  the  fault-free  laser  firing  zones  can  be  properly  evaluated 

ne  segments  are  subdivided  to  ensure  the  validity  of  this  condition.  In  MATILDA  the 

surroundmg  (non-flat)  terrain  can  be  represented  in  terms  of  a  stepped  terrain  profile  model 

Which  is  define  radially  with  respect  to  the  target  position.  The  terrain  profite  modTpro- 

v  des  means s  of  ensuring  against  the  possibility  of  short-range  irradiation  of  elevated  temain 

profile  is  atim  Tu  ^  Where  unProtected  Pers°ns  might  be  present.  A  terrain 
profile  is  a  simplified  representation  of  an  actual  landscape,  based  on  an  ascending  terrain 

fromthe  temet  F™1?  T*  ^  “  angUlar  SeCt°r  at  glven  radial  ^stances 

fin  ”  In  u  f  “  3  ten'am  Pr°flle  examPle  m  which  the  terrain  steps  are  de- 
ed  at  1-km  intervals,  within  1 0-degree  sectors  centered  on  the  target.  The  CRA  boundary 

ItiSestTf  th  Y  3  lme'  ThC  hdght  °f  6aCh  St6P  m  an  angUlar  SeCtor  is  defmed  by  ^ 

nearer  the  tarLrXmUm  ^  WitWn  ^  St6p’  °r  the  hdght  of  the  Prions  step 

The  extent  of  the  fault-free  laser  firing  zones  (FFLFZ)  can  be  affected  by  the  under- 
ymg  terrain  step  profile.  Thus,  it  is  important  that  the  FFLFZ  are  evaluated  using  the  cor- 
rect  underlymg  teiram  step  profile.  The  purpose  of  the  terrain  profile  condition  is  to  insert 
lonal  coordinates  at  the  points  of  intersection  between  the  line  segments  maldng  up 
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Fig.  7.  Terrain  profile  “web.” 


the  CRA  boundary  and  the  terrain  profile  sector  radials,  so  that  the  different  analytical  lay¬ 
ers  making  up  the  overall  clearance  solution  can  be  properly  aligned  geographically. 

The  urban  area  condition  adds  boundary  points  to  the  CRA  that  correspond  with  radials 
that  subtend  each  urban  area  in  the  vicinity  of  the  range.  The  small  increment  condition 
ensures  that  a  maximum  of  0.5  degrees  is  maintained  between  the  CRA  boundary  points. 
Additional  boundary  points  may  be  added  as  required.  The  undershoot/overshoot  condition 
ensures  that  each  CRA  boundary  point  is  mirrored  by  a  diametrically  opposite  boundary 
point  relative  to  the  target.  A  new  boundary  point  is  added  to  the  CRA  if  such  a  “mirror 
point”  does  not  exist.  Collectively  these  six  steps  result  in  a  set  of  boundary  coordinates 
along  the  CRA  boundary  that  will  be  used  subsequently  by  CALCZONE.  The  CRA  bound¬ 
ary  points  are  used  to  calculate  the  permissible  laser  firing  distances  at  various  compass 
points  around  the  target,  that  is,  the  fault- free  laser  firing  zones.  A  sample  CRA  generated 
by  the  RBPROG  module  is  shown  in  Fig.  8.  The  CRA  boundary  is  in  red  and  black,  with 
the  black  line  representing  an  alteration  to  the  range  boundary  needed  to  satisfy  the  star¬ 
shaped  condition. 

3.5.  CALCZONE  analysis  and  attack  track  definition 

The  second  module,  CALCZONE,  performs  the  fault-free  laser  hazard  analysis;  that  is,  it 
calculates  the  fault-free  laser  firing  zones  (FFLFZ)  for  each  designated  aircraft  altitude,  and 
the  specified  target  position,  using  the  CRA  defined  in  RBPROG.  The  procedure  for  this 
has  been  previously  described  in  Section  2.7.  For  any  aircraft  attack  track,  at  any  given  al¬ 
titude,  the  corresponding  FFLFZ  defines  the  maximum  range-to-target  at  which  the  laser 
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Fig.  8.  RBPROG  analysis  result:  CRA  with  additional  boundary  points. 


may  be  fired,  assuming  fault-free  operation  of  the  laser  directional  control  system.  The 
FFLFZ  provide  the  analyst  and  range  personnel  with  a  fault-free  operating  envelope.  An 
example  of  the  FFLFZ  contours,  specifying  firing  zones  for  different  altitudes,  generated 
and  displayed  by  MATILDA,  is  shown  in  Fig.  9. 

Generation  of  the  FFLFZ  completes  the  fault-free  laser  hazard  analysis  and  lays  the  foun¬ 
dation  for  the  probabilistic  fault/failure  hazard  analysis  performed  in  CALCFAULT.  Prior  to 
execution  of  CALCFAULT,  however,  a  specific  laser  attack  scenario  must  be  defined. 
MATILDA  provides  a  feature,  the  Attack  Track  Waypoint  Editor,  that  allows  an  analyst  to 
overlay  an  attack  track,  defined  by  a  series  of  waypoints,  onto  the  map.  The  data  entry  for 
waypoints  includes  waypoint  coordinates,  aircraft  altitude,  aircraft  velocity,  and  whether  the 
laser  is  firing  at  that  waypoint.  With  these  data,  MATILDA  compares  the  proposed  attack 
track  against  the  altitude  limitations  defined  by  the  FFLFZ  and  indicates  to  the  analyst  those 
portions  of  the  track  that  are  cleared  for  laser  firing  and  those  where  laser  firing  is  prohibited. 
Fig.  10  gives  an  example  of  such  a  user-entered  attack  track.  Note  that  the  vast  majority  of 
the  attack  track  is  colored  green,  and  hence  cleared  for  firing,  but  a  small  portion  at  the  end 
violates  FFLFZ  altitude  limitations,  and  is  therefore  colored  red.  Only  the  portion  of  the  attack 
track  that  clears  FFLFZ  restrictions  is  analyzed  during  CALCFAULT  execution. 

3.6.  CALCFAULT  analysis 

The  third  module,  CALCFAULT,  performs  the  probabilistic  fault/failure  hazard  analysis  for 
the  designated  and  cleared  laser  attack  scenario,  to  determine  if  any  additional  restrictions 
must  be  imposed  on  the  laser  firing  envelope  permitted  by  the  FFLFZ.  The  CALCFAULT 
analysis  quantifies  the  actual  risk  for  firing  along  the  designated  attack  track,  in  the  event  of 
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Fig.  9.  MATILDA-generated  fault-free  laser  firing  zones. 


Fig.  10.  Fault-free,  attack  track  check. 


a  fault  in,  or  a  failure  of,  the  laser  directional  control  system.  The  probabilistic  laser  pointing 
error  model  and  probabilistic  ocular  damage  model  discussed  in  Section  2  are  used  in  this 
analysis.  Key  input  parameters  for  the  CALCFAULT  analysis  include  laser  system  parameters. 
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attack  track  rifta^  population  densities  of  the  urban  areas  surrounding  the  range,  the  terrain 
computational  grid  (points  on  the  ground  for  which  ocular  damage  probability  is  computed), 
and  of  course,  the  maximum  acceptable  value  of  the  overall  damage  probability,  EM0VLMAX. 

For  each  laser  pulse  fired  during  the  course  of  a  specified  aircraft  attack  track,  the 
CALCFAULT  algorithm  evaluates  a  corresponding  expectation  value,  e^^,  that  a  MOVL 
will  occur  in  the  unprotected  population  surrounding  the  CRA.  The  number  of  pulses  emit¬ 
ted  after  a  fault  or  failure  has  occurred  depends  on  the  pulse  repetition  frequency  (PRF)  and 
the  length  of  time  required  for  the  laser  to  cease  firing  (maximum  duration  of  fault  firing). 
Consequently,  the  overall  expectation  value,  EM0VL,  of  a  MOVL  occurring  in  the  unpro¬ 
tected  population,  is  the  sum  of  the  individual  (pulse-based)  eM0VL  values  for  the  period  of 
time  during  which  the  laser  continues  to  fire,  before  laser  firing  is  inhibited.  Restrictions 
on  laser  firing  are  subsequently  imposed  on  those  portions  of  the  aircraft  maneuver  for 
which  the  calculated  value  of  Emovl  exceeds  the  acceptable  limit. 

For  the  current  analysis,  MATILDA  first  uses  the  20-Hz  PRF  and  the  user-defined  attack 
track  to  determine  the  location  of  each  pulse  emitted  during  an  attack.  These  laser  firing 
points  are  then  used  to  determine  a  beam  footprint  whose  boundaries  are  defined  by  the  max¬ 
imum  pointing  error  entered  (20  degrees).  The  only  terrain  grid  points  evaluated  for  each 
ew„„  are  those  that  fall  within  the  area  defined  by  the  beam  footprint.  The  number  of  these 

MUVL  .  _ 

areas  actually  considered  for  EM0VL  is  dependent  on  the  PRF  and  the  maximum  duration  of 
fault  firing,  which  indicate  how  many  total  pulses  need  to  be  evaluated,  assuming  that  a  laser 
control  error  occurs  when  the  aircraft  reaches  a  particular  laser  firing  point. 

Since  there  is  uncertainty  in  knowing  when  the  fault  will  occur,  the  EM0VL  calculation 
must  be  carried  out  for  a  possible  laser  control  error  occurring  at  each  laser  firing  point  in 
the  entire  engagement.  The  goal  is  to  limit  the  value  of  EM0VL  for  any  possible  failure  sce¬ 
nario  to  the  maximum  acceptable  value,  LMOV]MAX.  In  the  case  of  the  analysis  shown  here, 
EMOvlmax  was  H'any  EMovLvalue  for  anY  possible  failure  scenario  is  found  to  exceed 
EMOvlmax>  then  the  analyst  has  a  choice  of  either  converting  that  section  of  the  attack  track 
to  a  prohibited  firing  region,  or 
modifying  the  attack  track  to  re¬ 
duce  the  Emovl  value. 

Figure  11  shows  a  compari¬ 
son  of  all  Ej^qvl  values  to  the  ac¬ 
ceptable  risk  threshold.  The  5200 
Emovl  values  plotted  in  Fig.  11 
are  calculated  for  a  possible  laser 
control  error  occurring  at  each  of 
5200  possible  laser  firing^pdsi- 
tions,  along  the  FFLFZ-cleared 
attack  track  shown  in  Fig.  10. 

Each  Emovl  value  consists  of  the 
sum  of  60  eM0VL  values,  repre¬ 
senting  the  60  pulses  fired  during 
the  3-second  shutdown  period 
following  the  control  error.  In 
this  case,  the  FFLFZ-tleared  at¬ 
tack  track  does  not  exceed  the  ac- 


Fig.  11.  Comparison  of  values 
t0  emovlmax  criterion. 
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ceptable  risk  threshold  for  a  laser  control  error  at  any  of  the  5200  firing  points.  It  would 
therefore  be  approved  for  laser  firing  without  modification. 


4.  Discussion 

The  concept  ot  PRA  and  its  application  to  military  laser  safety  in  outdoor  environments  has 
been  gaining  in  ascendancy  in  recent  years,  as  the  advantage  of,  and  the  necessity  for,  a 
probabilistic  approach  to  laser  hazard  analysis  has  become  increasingly  accepted.  The  ad¬ 
vantage  of  a  PRA-based  solution  over  the  standard  risk  analysis  method  involving  evalua¬ 
tion  of  the  NOHD  is  amply  illustrated  in  Fig.  12,  in  which  a  deterministic  ocular  hazard 
zone  (DOHZ),  based  on  the  single-pulse  NOHD,  is  compared  with  a  probabilistically  de¬ 
rived  laser  hazard  area  trace  (LHAT)  that  has  been  defined  for  all  laser  pulses  emitted  during 
the  attack  sequence.  In  this  case,  the  PRA-based  LHAT  is  much  smaller  in  extent  than  the 
DOHZ.  Additionally,  the  variation  of  risk  with  location  inside  the  LHAT  can  be  evaluated, 
whereas  the  interior  of  the  DOHZ  can  only  be  described  as  “unsafe.”  As  an  example  of  how 
this  might  benefit  the  DOD,  AFRL  personnel  have  done  probability  of  injury  analysis,  as  a 
function  of  location  of  ground  observers,  for  reflections  from  airborne  ordnance  targeted 
by  Army  ground-based  laser  systems. 

PRA-based  methods  are  thus  perceived  to  offer  greater  flexibility  to  the  laser  system 
operator,  while  maintaining  acceptable  levels  of  safety  for  unprotected  members  of  the  gen- 
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Fig.  12.  Comparison  of  PRA-based  laser  hazard  area  trace  with  deterministic  ocular  hazard  zone. 
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eral  public.  On  the  other  hand,  the  PRA-based  method  does  not  come  without  additional 
cost.  Due  to  the  smaller  margins  of  safety  involved  in  the  PRA  method,  based  on  what  is 
deemed  to  satisfy  the  ALARP  principle,  a  substantial  amount  of  preliminary  effort  is  re¬ 
quired  to  establish  the  performance  attributes  of  the  laser  system  and  ensure  the  validity  of 
the  subsequent  hazard  analysis.  The  Laser  System  Safety  Investigation  (LSSI)  needed  to 
adequately  characterize  the  fault-free  performance  and  fault/failure  characteristics  of  the 
laser  directional  control  system,  has  been  described  in  detail  in  a  previous  publication.13 

Perhaps  the  most  important  requirement  of  the  PRA-based  clearance  method  is  the  de¬ 
termination  of  what  level  of  risk  is  deemed  to  be  acceptable  to  unprotected  members  of  the 
general  public  in  the  vicinity  of  laser  system  test  or  training  operations.  The  acceptable  level 
of  risk  will  vary  from  one  jurisdiction  to  another,  and  should  be  decided  at  an  appropriate 
policy  level  within  the  host  country’s  chain  of  executive  responsibility.  As  mentioned  in 
Section  2.6,  the  maximum  acceptable  risk  level  set  by  the  UK  MoD  is  10-8  occurrences  of 
MOVL  per  attack.  There  is  currently  no  acceptable  risk  level  specified  for  U.S.  ranges,  be¬ 
cause  PRA  is  still  too  new  in  Department  of  Defense  applications.  The  identified  acceptable 
level  of  risk  will  have  an  impact  on  the  flexibility'  of  the  resulting  clearance  restrictions.  In 
general,  the  more  stringent  are  the  safety  criteria,  the  less  flexible  will  be  the  resulting  clear¬ 
ance  restrictions. 


5.  Conclusion 

The  use  of  PRA  techniques  to  perform  laser  safety  and  hazard  analysis  for  high  output  lasers 
in  outdoor  environments  has  become  an  increasingly  accepted  alternative  to  standard  risk 
analysis  methods,  based  on  MPE  limits.  Over  the  past  10  years,  the  UK  MoD  and  the  U.S. 
AFRL  have  collaborated  to  develop  a  jointly  owned,  PRA-based,  laser-range  safety  tool, 
the  MATILDA  system. 

PRA-based  laser  hazard  analysis  offers  a  number  of  advantages  over  standard  risk 
analysis  methods.  First,  it  provides  a  quantified  assessment  of  human  risk  (probability  of 
injury)  as  a  function  of  location.  Second,  it  captures  the  probabilities  and  consequences  of 
human  error  and  laser  fault/failure  conditions,  factors  which  are  critical  to  valid  hazard  as¬ 
sessments  for  military  laser  operations  in  uncontrolled  outdoor  environments.  Third,  and 
most  importantly,  PRA  analysis  does  not  assume,  or  require,  a  zero  risk  condition  as  a  final 
result.  Instead,  it  compares  the  quantified  risk  against  a  maximum  acceptable  (non-zero) 
risk  value.  This  produces  less  restrictive  range  clearances,  while  still  maintaining  safety 
levels  deemed  acceptable  for  range  personnel  and  members  of  the  public.  This  last  advan¬ 
tage  is  critical  for  the  UK,  where  the  small  size  of  UK  ranges  and  the  possibility  that  laser 
beams  might  escape  range  boundaries  make  a  zero  risk  condition  for  range  testing  unac¬ 
ceptably  restrictive. 

Over  the  past  four  decades,  the  UK  MoD  has  pioneered  the  development  of  PRA-based 
models  for  laser  hazard  assessment,  using  them  to  assess  laser  irradiation  risks  to  unpro¬ 
tected  persons  from  outdoor  test  and  training  operations  on  UK  military  ranges.  The  USAF 
has  also  identified  the  need  for  a  PRA-based  approach  in  the  quantification  of  laser  hazards. 
Discussions  between  the  USAF  and  the  UK  MoD  Tevealed  a  common  objective  in  devel¬ 
oping  a  jointly  ottaied,  PRA-based,  laser  range  safety  tool.  Thus,  UK  laser  PRA  modeling 
expertise  and  AFRL  expertise  in  development  of  advanced  laser  hazard  assessment  tools 
were  combined  to  create  the  MATILDA  tool. 
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The  MATILDA  system  is  a  new  software  tool  based  on  open-source  GIS  technology 
that  integrates  relevant  laser-system  performance  parameters  with  environmental  data  ap¬ 
propriate  to  the  range  location  where  the  system  is  being  operated.  It  provides  a  modem, 
low-cost,  portable  computational  environment,  which  may  be  tailored  equally  to  the  needs 
of  the  local  range  safety  technician  and  the  expert  analyst.  MATILDA  provides  the  user/an¬ 
alyst  with  the  means  to  efficiently  assess  risks  arising  from  different  attack  profiles  on  any 
given  target,  and  ensures  that  the  results  are  consistent  with  acceptable  safety  criteria.  The 
result  is  an  optimum  level  of  flexibility  in  laser  range  operations,  while  still  maintaining 
high  standards  of  safety  for  unprotected  persons  near  the  range.  MATILDA  is  the  first  mil¬ 
itary  software  tool  to  contain  a  complete  end-to-end  laser  PRA  model,  crafted  for  range  ap¬ 
plications,  and  with  generalized  terrain  modeling.  In  the  ftiture  it  will  provide  a  starting 
point  for  development  of  more  advanced  laser  PRA  models  and  tools. 
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